CVE-2026-18600 in GL-MT3000
Summary
by MITRE • 08/03/2026
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability identified in GL.iNet GL-MT3000 devices running firmware versions up to 4.4.5 represents a critical command injection flaw within the network switch functionality of the device's web interface. This security weakness resides in the Network Lua RPC Plugin component, specifically affecting the network.switch_info and network.switch_status functions located within the /usr/lib/oui-httpd/rpc/network file path. The vulnerability stems from inadequate input validation and sanitization within the RPC plugin architecture, where user-supplied parameters are directly incorporated into system commands without proper escaping or filtering mechanisms.
The technical exploitation of this vulnerability occurs through manipulation of the switch argument parameter within the affected RPC functions, allowing attackers to inject malicious command sequences that execute with the privileges of the web server process. This represents a classic command injection vulnerability classified under CWE-77, where untrusted data flows into a command processor without proper validation or sanitization. The attack vector is remote, meaning adversaries can exploit this weakness from external networks without requiring physical access to the device, making it particularly dangerous for network infrastructure components.
The operational impact of this vulnerability extends beyond simple unauthorized command execution, as it provides attackers with potential full control over the affected router's network switching capabilities and underlying system functions. Attackers could leverage this weakness to modify network configurations, establish persistent backdoors, or redirect traffic through malicious intermediaries, effectively compromising the entire network segment managed by the vulnerable device. The confirmed disclosure of exploit code further amplifies the risk, as it removes the requirement for advanced technical knowledge to execute successful attacks against these devices.
Mitigation strategies should prioritize immediate firmware updates from GL.iNet to address the command injection vulnerability, while network administrators should implement additional protective measures such as restricting remote access to administrative interfaces, implementing network segmentation, and deploying intrusion detection systems to monitor for suspicious RPC traffic patterns. The vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter, specifically focusing on the use of web shell or RPC-based command execution within network infrastructure devices.
The nature of this vulnerability also highlights critical gaps in the secure development lifecycle practices of embedded networking equipment, particularly regarding input validation in RPC components that handle network configuration parameters. Organizations managing GL.iNet devices should conduct comprehensive security assessments of their network infrastructure, verify proper access controls on administrative interfaces, and implement continuous monitoring for unauthorized modifications to network switch configurations. The confirmed vendor acknowledgment of the vulnerability underscores the need for proactive security measures and demonstrates the importance of maintaining current firmware versions to protect against known security weaknesses in network infrastructure equipment.